Cookies are a small piece of data sent from a website and stored on a user's web browser while the user is accessing the website. The website can use a cookie to verify the user's return to the site and obtain details about the user's previous activity. This can include what pages were accessed, how they logged in, and what buttons were pressed. Anytime you log into a website, such as Facebook, Gmail, or Wordpress, your browser assigns you a cookie.
Cookies can include tracking history from users for long periods of time, including behavior on a website years ago. Cookies can also store passwords and form values a user has previously filled, such as their home address or credit card number. This is useful for businesses such as retail looking to provide a simplified experience for their consumers. A session token is delivered from a web server anytime a host authenticates. The session token is used as a way to recognize among different connections. Session hijacking occurs when an attacker captures a session token and injects it into their own browser to gain access to the victim's authenticated session. Essentially, it is the act of replacing an attacker's unauthorized cookie with a victim's authorized cookie.
There are some limitations of session hijacking attacks:
- Stealing cookies is useless if the target is using
https://for browsing, and end-to-end encryption is enabled. Adoption has been slow; however, most secured websites provide this defense against session hijacking attacks.Note
You can use SSLstrip as a method to prevent your target from establishing an
httpsconnect prior to launching a session hijack or other attack. See Chapter 3, Server-Side Attacks, for more information on SSLstrip. - Most cookies expire when the target logs out of a session. This also logs the attacker out of the session. This is a problem for some mobile apps that leverage cookies that don't expire, meaning an attacker could gain access for life if a valid session token is captured.
Many websites do not support parallel logins, which negates the use of a stolen cookie.